A vulnerability assigned in 2021 that entered KEV in 2026 (CVE-2021-30952) — and what the label Multiple Products covers

1Why an overflowing integer ends in running code

An integer overflow is what happens when a calculation exceeds the range a variable can hold and turns into an unintended small or negative value. It looks like a mere arithmetic error, but the picture changes when that value is used as the size of a memory allocation. More data gets written than the allocated region holds, and memory that should not change is overwritten.

Hijacking the flow of execution from there is the classic path, which is why this record says arbitrary code execution may follow.

2A five-year gap, on the record

The CVE number was assigned in 2021; the addition to KEV came in 2026. Counting the gap between the year of CVE assignment and the year of KEV addition across the 1,685 records this site holds as of 2026-08-28, the same year accounts for 722 of them — 43 percent.

But records with wide gaps like this one are present in numbers too, showing that KEV is not a bulletin of new vulnerabilities but a ledger of ones confirmed as exploited. That is why age alone is not grounds for dropping an entry.

3The label Multiple Products

The catalog gives the product as Multiple Products and names five in the description: tvOS, macOS, Safari, iPadOS and watchOS. Products with different purposes share one vulnerability because they share a common foundation for processing web content.

Grouping the 1,685 records this site holds as of 2026-08-28 by product name, the single label Apple Multiple Products accounts for 53 of them, a scale comparable to Microsoft Windows at 172 and Google Chromium V8 at 39. One fault in one foundation surfaces to users as separate products.